Understanding Social Engineering Tricks and How to Prevent It

In the digital age, social engineering and phishing represent significant threats to security and privacy, impacting an array of digital platforms—from social media and messaging apps to digital commerce, payment companies, and online banking. Recent statistics indicate a rising trend in social engineering cases, with substantial financial losses incurred annually. Understanding these threats is crucial to protecting the ecosystem and ensuring the safety of all stakeholders involved.

What is Phishing and Social Engineering?

Phishing and social engineering are sophisticated forms of cyberattacks that manipulate individuals rather than exploiting software vulnerabilities. Every year, 58% of corporate system users who took risky actions engaged in behavior that would have made them vulnerable to common social engineering tactics. These tactics have evolved over time to become more complex, adapting to advancements in cybersecurity measures.

Definition and Types

Social engineering involves psychological manipulation to trick users into making security mistakes or giving away sensitive information. Phishing is a tactic of social engineering where attackers impersonate trusted entities to extract sensitive data such as name, address, bank details, and credit card details. This includes various methods like email phishing, vishing (voice phishing), smishing (SMS phishing), spear phishing, and whaling—this specific type targets senior management to obtain control of the internal system and access privileged data. Let’s look at some real-life examples:

• Fake Brand Promotions: Attackers create counterfeit advertisements offering unrealistic discounts on popular products to lure consumers into providing personal details.

Singapore Police have issued warnings about a rising scam trend where criminals impersonate banks via SMS, offering high-interest fixed deposit schemes to lure victims into fraudulent transactions, leading to at least 12 victims losing a total of S$650,000 since January, 2024 (CNA).

• Government Imposter Scam: fraudsters pretend to be from the government and create websites to collect personal information. This method exploits the trust people have in official communications to deceive them into providing sensitive data.

Singapore Police have issued a warning about a new phishing scam involving fraudulent Budget 2024 infographics circulated via Telegram. These infographics falsely claim to be from the Ministry of Finance and trick victims into clicking a link that leads to a fake website, purportedly to verify eligibility for government cash disbursements. Victims are asked for personal details, which then leads to unauthorized login attempts on their Telegram accounts (CNA).

• Impersonation of Customer Service: Phishers mimic legitimate customer support to mislead customers and direct them to malicious sites under the guise of resolving issues.
• CEO Fraud: Also known as Business Email Compromise (BEC). It is a scam where cybercriminals impersonate a company's executive to trick employees into sending money or confidential information. This type of fraud relies on the perceived authority of the executive and often involves urgent, deceptive requests.

Jaime Ondarza, Fremantle's CEO for Southern Europe, has resigned after mistakenly sending nearly €940,000 to cybercriminals in a CEO fraud scam. The fraudsters, posing as senior executives, convinced Ondarza to transfer funds for a fictitious company acquisition in Asia.  (TBI Vision)

• Account Takeover Attacks: Attackers gain access to genuine social media accounts and use them to send phishing links or requests for data to trusted contacts, exploiting established trust and credibility.

Why Do Employees Take Risky Actions?

To understand the reasons behind actions that lead individuals to fall victim to phishing, we must first recognize the emotions that guide these decisions. Adu-Manu et al. (2022) identify emotions such as greed, fear, curiosity, mesmerization, and empathy as key emotional drivers that contribute to phishing attacks. Fraudsters often manipulate these feelings to lure users into taking risky actions, such as clicking on phishing emails or accepting deceptive offers that appear harmless. Additionally, intentional factors like the convenience of saving time, meeting deadlines or targets, and conserving money also play significant roles in making these risky decisions more appealing.

Common and Emerging Tactics in Phishing and Social Engineering

Phishing and social engineering tactics continually evolve as cybercriminals employ increasingly sophisticated methods to bypass security measures and exploit human vulnerabilities. Below are some of the most prevalent techniques used in these attacks:

• Human Interventions: At the heart of social engineering lies the manipulation of human emotions and behaviors. Cybercriminals use deceptive tactics that necessitate robust countermeasures such as ongoing education and strict policy enforcement to protect individuals.
• Blacklist/Whitelist/Blocklist/Phishtank: Attackers adeptly navigate around or mimic the appearance of sites on security lists, presenting significant challenges to traditional defenses that rely on these repositories for identifying threats.
• Web Structure/Content Matching: A common strategy involves cloning the structure and content of legitimate websites. This tactic tricks victims into believing they are interacting with authentic sites, thereby increasing the likelihood of divulging sensitive information.
• URL Similarity: Fraudsters create URLs that closely resemble those of legitimate sites, a method designed to deceive users by exploiting their familiarity and trust in known web addresses.
• Web Access Log Matching: By accessing and analyzing web traffic logs, attackers can craft convincing phishing sites that mimic legitimate user activities, making these sites appear more credible and thereby fooling even the vigilant users.
• Multi-layer Techniques: To enhance their success rate, attackers often combine several deceptive techniques. This multi-layered approach increases the complexity of the attacks, making it harder for standard security measures to detect and block them.

Safeguarding Your Digital Platform

Whether it is social media, messaging app, digital commerce, payment companies or online banking — having the capability to identify and prevent phishing activities should be the new benchmark of all digital platforms to ensure digital inclusion for end-users.

User-Level Interventions

• Education and Training: Continuous education and training programs are vital. They help individuals recognize and respond to phishing attempts, particularly those that use sophisticated social engineering tactics. Regular training sessions can significantly enhance users' awareness and preparedness against these threats.
• Cybersecurity Policies: Strong cybersecurity policies are the backbone of any secure organization. These policies guide user behavior and ensure compliance, significantly reducing the vulnerability to phishing and other cyber-attacks. It's essential for organizations to develop clear guidelines that are regularly updated to reflect new cybersecurity threats.
• Protection of Personal Privacy: Educating staff and users on the importance of protecting personal information is crucial. This education can prevent attackers from gathering critical data through seemingly innocuous interactions or deceptive requests.
• Legal Solutions: Implementing legal measures can reinforce the overall security framework of a platform, deterring cybercriminals by increasing the potential consequences of their actions.

Device-Level Interventions

• Domain Black List: Utilizing blacklists to block known malicious domains is a straightforward yet effective way to prevent access to harmful websites. This strategy reduces the risk of phishing attacks by preventing users from inadvertently accessing dangerous sites.
• Machine Learning: Machine learning algorithms can play a pivotal role in enhancing security measures. These technologies detect unusual site behavior or anomalous data patterns, which are indicative of sophisticated and previously unknown phishing attempts.
• URL Similarity: Tools that compare the URLs visited by users to a list of known phishing sites can block deceptive attempts that mimic legitimate websites. This is crucial in preventing users from falling victim to sites that look similar to those they trust.
• Web Structure/Content Similarity: Analyzing the structure and content of websites to identify copies or near-duplicates of legitimate sites is an effective method to detect and prevent phishing attempts. This analysis helps identify sites designed to fool users by mimicking the appearance of trusted sites.
• Web Access Logs: Monitoring web access logs provides insights into unusual patterns that might indicate phishing activities. Quick responses to these indicators can mitigate potential threats before they cause harm.
• PhishTank Integration: Incorporating data from sources like PhishTank into security protocols ensures that organizations are continuously updated about new and emerging phishing threats. This integration enhances proactive defenses, keeping security measures one step ahead of cybercriminals.

In A Nutshell

The relentless evolution of social engineering and phishing necessitates a vigilant, multi-layered approach to cybersecurity across all digital platforms. As these threats evolve to be more sophisticated, the importance of implementing robust user-level and device level intervention cannot be overstated. By educating users, enforcing strong cybersecurity policies, and utilizing advanced technological measures, organizations can significantly enhance their defenses against these deceptive tactics. Ultimately, maintaining a secure digital environment is not just about protecting data—it's about safeguarding the trust and wellbeing of every user in the digital ecosystem.

Reference

Sarpong Adu-Manu, K., Kwasi Ahiable, R., Kwame Appati, J., & Essel Mensah, E. (2022). Phishing attacks in Social Engineering: A Review. Journal of Cyber Security, 4(4), 239–267. https://doi.org/10.32604/jcs.2023.041095

‍